Re: [PATCH v6 2/4] bpf: arena: allocate the fault-in page outside the lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Uninitialized kernel memory can be mapped to user space via the non-blocking BPF arena page allocator.
--

--- Patch [2]: [PATCH v6 2/4] bpf: arena: allocate the fault-in page outside the lock ---
commit ff315e328e06f5f1bb6983dd7c2505e416510536
Author: Jiayuan Chen <jiayuan.chen@linux.dev>

bpf: arena: allocate the fault-in page outside the lock

This commit reworks arena_vm_fault() to preallocate the fault-in page outside
the lock, allowing it to sleep and use memory reclaim. It handles failures by
returning VM_FAULT_SIGBUS instead of SIGSEGV, and uses a lockless probe to
skip preallocation when possible.

> diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c
> index 7b6847200b431..fa462a0ff1ad6 100644
> --- a/kernel/bpf/arena.c
> +++ b/kernel/bpf/arena.c
[ ... ]
> @@ -489,59 +490,106 @@ static vm_fault_t arena_vm_fault(struct vm_fault *vmf)
>  	kbase = bpf_arena_get_kern_vm_start(arena);
>  	kaddr = kbase + (u32)(vmf->address);
[ ... ]
> +	if (!new_page) {
> +		/*
> +		 * Very rare race: the bpf program had allocated a page here, so
> +		 * the lockless probe saw it and we skipped preallocation, but it
> +		 * freed the page before we took the lock. Now we do need one;
> +		 * sleeping is not allowed here, so fall back to the non-blocking
> +		 * allocator and give up if it fails.
> +		 */
> +		ret = bpf_map_alloc_pages(map, map->numa_node, 1, &new_page);

[Severity: Critical]
This is a pre-existing issue, but does this fallback path expose uninitialized
kernel memory to user space?

When this rare race happens and we call bpf_map_alloc_pages() under the
arena->spinlock, preemption is disabled. The bpf_map_alloc_pages() function
calls __bpf_alloc_page(), which checks can_alloc_pages() (returning false
because preemption/IRQs are disabled).

It then falls back to alloc_pages_nolock():

kernel/bpf/syscall.c:__bpf_alloc_page() {
    ...
    if (!can_alloc_pages())
        return alloc_pages_nolock(__GFP_ACCOUNT, nid, 0);
    ...
}

The __GFP_ACCOUNT flag completely omits __GFP_ZERO. This causes the raw page
allocator to return an unzeroed page. This page is then mapped into the user
VMA via apply_to_page_range(), which allows user space to read the residual
kernel data.

Since this new fallback path relies on the same non-blocking allocator, it
appears vulnerable to the same issue. Can __GFP_ZERO be added to the
alloc_pages_nolock() call to prevent this?

> +		if (ret) {
> +			fault_ret = VM_FAULT_SIGBUS;
> +			goto out_err_locked_memcg;
> +		}
> +	}
>  
>  	ret = range_tree_clear(&arena->rt, vmf->pgoff, 1);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825091952.81971-1-ahemadkhawar123@gmail.com?part=2